linear-sdk-cli 0.8.2 → 0.9.0

package/src/config.ts

@@ -2,7 +2,7 @@
  * Configuration resolution.
  *
  * Two tiers with different trust boundaries:
- *  - Non-secret settings (team, workspace, sort): flag > env > project
+ *  - Non-secret settings (team, workspace, project, sort): flag > env > project
  *    config > selected workspace profile (team only) > user config
  *    (`~/.config/linear/config.toml`) > the reference CLI's global config
  *    (`~/.config/linear/linear.toml`, read-only).
@@ -68,6 +68,7 @@ import {
 export interface RawSettings {
   team?: string;
   workspace?: string;
+  project?: string;
   sort?: string;
   apiKey?: string;
   accessToken?: string;
@@ -102,7 +103,7 @@ export interface SettingOrigin {
 }
 
 /** The non-secret settings, each with its provenance. */
-export type SettingOrigins = Record<"team" | "workspace" | "sort", SettingOrigin>;
+export type SettingOrigins = Record<"team" | "workspace" | "project" | "sort", SettingOrigin>;
 
 export interface ResolvedConfig {
   apiKey?: string;
@@ -130,6 +131,8 @@ export interface ResolvedConfig {
   team?: string;
   /** Non-secret display workspace setting (separate from credentialWorkspace). */
   workspace?: string;
+  /** Default Linear project name or id for issue creation only. */
+  project?: string;
   sort: string;
   /** Where `sort` came from, so an invalid value can be blamed precisely. */
   sortSource: ConfigSource;
@@ -215,7 +218,7 @@ interface UserConfig {
   workspaces: Record<string, WorkspaceEntry>;
 }
 
-type NonSecretSetting = "team" | "workspace" | "sort";
+type NonSecretSetting = keyof SettingOrigins;
 type SettingKeys = Partial<Record<NonSecretSetting, string>>;
 
 interface FileSettings {
@@ -299,6 +302,7 @@ function settingsFromParsed(parsed: Record<string, unknown>): FileSettings {
   const found = [
     read("team", ["team", "team_id"]),
     read("workspace", ["workspace"]),
+    read("project", ["project"]),
     read("sort", ["sort", "issue_sort"]),
   ];
   const settings: RawSettings = {};
@@ -468,6 +472,7 @@ function fromEnv(env: NodeJS.ProcessEnv): RawSettings {
     accessToken: env.LINEAR_ACCESS_TOKEN,
     team: env.LINEAR_TEAM || env.LINEAR_TEAM_ID,
     workspace: env.LINEAR_WORKSPACE,
+    project: env.LINEAR_PROJECT,
     sort: env.LINEAR_ISSUE_SORT,
   };
 }
@@ -645,7 +650,7 @@ export function resolveConfig(inputs: ConfigInputs = {}): ResolvedConfig {
     ["user", user.settings, userPath, user.settingKeys],
     ["global", global.settings, globalPath, global.keys],
   ];
-  const pick = <K extends "team" | "workspace" | "sort">(key: K): string | undefined =>
+  const pick = (key: NonSecretSetting): string | undefined =>
     tiers.find(([, settings]) => settings[key] !== undefined)?.[1][key];
 
   const profileTeam = workspaceProfile ? user.workspaces[workspaceProfile]?.team : undefined;
@@ -664,7 +669,7 @@ export function resolveConfig(inputs: ConfigInputs = {}): ResolvedConfig {
   ];
 
   /** Which tier `pick` took the value from, and which file if it was one. */
-  const originOf = (key: "team" | "workspace" | "sort"): SettingOrigin => {
+  const originOf = (key: NonSecretSetting): SettingOrigin => {
     const candidates = key === "team" ? teamTiers : tiers;
     const hit = candidates.find(([, settings]) => settings[key] !== undefined);
     if (!hit) return { source: "none" };
@@ -678,6 +683,7 @@ export function resolveConfig(inputs: ConfigInputs = {}): ResolvedConfig {
   const origins: SettingOrigins = {
     team: originOf("team"),
     workspace: originOf("workspace"),
+    project: originOf("project"),
     sort: originOf("sort"),
   };
 
@@ -696,6 +702,7 @@ export function resolveConfig(inputs: ConfigInputs = {}): ResolvedConfig {
     // The display setting walks every tier. Credential selection above uses
     // the flag, env, and project tiers, then the auth-specific user default.
     workspace: pick("workspace"),
+    project: pick("project"),
     sort: pick("sort") ?? "priority",
     sortSource: origins.sort.source,
     origins,
@@ -958,6 +965,246 @@ function workspacesTable(obj: Record<string, unknown>): Record<string, Workspace
   return obj.workspaces as Record<string, WorkspaceTable>;
 }
 
+interface ProfileRename {
+  from: string;
+  to: string;
+  phase: "prepared" | "committed";
+  keyring: boolean;
+}
+
+export interface RenameProfileResult {
+  path: string;
+  storage: CredentialStorage;
+  team: string | null;
+  defaultWorkspace: string | null;
+  referenceCredentialsPath: string | null;
+}
+
+/**
+ * Move an API-key profile without login/logout or revocation. The private config
+ * contains a non-secret recovery marker until all stores agree. Copy, verify,
+ * commit metadata, update the shared reference list, then delete the old secret.
+ * Retrying the same command resumes an interrupted operation; never overwrite a
+ * destination belonging to another operation, even when its key happens to match.
+ * OAuth lifecycles are deliberately excluded (including dormant fallback records).
+ */
+export async function renameApiKeyProfile(
+  from: string,
+  to: string,
+  validate: (apiKey: string) => Promise<void>,
+): Promise<RenameProfileResult> {
+  const slugPattern = /^[a-z0-9](?:[a-z0-9-]{0,98}[a-z0-9])?$/;
+  if (!slugPattern.test(from) || !slugPattern.test(to) || from === to)
+    throw new CliError("Pass two different lowercase Linear workspace URL slugs.", "usage");
+  const path = userConfigPath();
+  const referencePath = referenceCredentialsPath();
+  const lock = acquireUserConfigLock(path);
+  const retry = `linear auth rename ${from} ${to}`;
+  let started = false;
+  let step = "save the recovery marker in the private user config";
+  try {
+    const obj = readUserObject(path);
+    const ws = workspacesTable(obj);
+    const pending = obj.api_key_profile_rename as ProfileRename | undefined;
+    if (
+      pending &&
+      (pending.from !== from ||
+        pending.to !== to ||
+        !["prepared", "committed"].includes(pending.phase) ||
+        typeof pending.keyring !== "boolean")
+    )
+      throw new CliError(
+        "Another profile rename is pending. Complete the original `auth rename <old-slug> <new-slug>` command first (see api_key_profile_rename in the private user config).",
+        "usage",
+      );
+    const user = readUserConfig(path);
+    if (
+      (pending?.phase === "prepared" && Object.hasOwn(ws, to)) ||
+      (pending?.phase === "committed" && Object.hasOwn(ws, from))
+    )
+      throw new CliError(
+        "Profile metadata conflicts with the pending rename. No credentials were removed.",
+        "runtime",
+      );
+    const selected = pending?.phase === "committed" ? to : from;
+    const entry = user.workspaces[selected];
+    if (!entry || !Object.hasOwn(user.workspaces, selected))
+      throw new CliError(`Workspace '${selected}' is not configured.`, "not_found");
+    if (entry.oauth || entry.app || entry.appFileCredential !== undefined)
+      throw new CliError(
+        "`auth rename` supports API-key profiles only. OAuth user sessions rotate refresh tokens; OAuth app profiles bind organization identity and acquire scoped tokens. Neither lifecycle is migrated by this command. Credentials and grants were left unchanged.",
+        "usage",
+      );
+    if (!pending && Object.hasOwn(user.workspaces, to))
+      throw new CliError(
+        `Destination workspace '${to}' is already configured. Nothing changed.`,
+        "usage",
+      );
+
+    const backend = keyring();
+    const readAccount = (account: string): string | null => {
+      try {
+        return backend?.get(account) ?? null;
+      } catch {
+        throw new CliError(
+          "Could not inspect the system keyring. No credentials were removed.",
+          "runtime",
+        );
+      }
+    };
+    // Probe exact names, including unlisted destinations and inactive OAuth records.
+    for (const slug of [from, to]) {
+      if (readAccount(oauthAccount(slug)) !== null || readAccount(`app:${slug}`) !== null)
+        throw new CliError(
+          `Workspace '${slug}' has an OAuth keyring record. API-key-only rename cannot move or replace it. Credentials and grants were left unchanged.`,
+          "usage",
+        );
+    }
+    const oldKey = readAccount(from);
+    const destinationKey = readAccount(to);
+    if (!pending && destinationKey !== null)
+      throw new CliError(
+        `Destination '${to}' already exists in the system keyring. Nothing changed.`,
+        "usage",
+      );
+    const apiKey = entry.apiKey ?? (selected === from ? oldKey : destinationKey);
+    if (!apiKey)
+      throw new CliError(
+        "The selected stored API key is unavailable. No credentials were removed.",
+        "auth",
+      );
+    if (
+      (oldKey !== null && oldKey !== apiKey) ||
+      (destinationKey !== null && destinationKey !== apiKey)
+    )
+      throw new CliError(
+        "A rename credential changed or conflicts with the stored profile. No credentials were removed.",
+        "runtime",
+      );
+    const movesKeyring = pending?.keyring ?? oldKey !== null;
+    if (pending && !movesKeyring && (oldKey !== null || destinationKey !== null))
+      throw new CliError(
+        "Credential storage changed since this rename started. No credentials were removed.",
+        "runtime",
+      );
+    if (movesKeyring && !backend)
+      throw new CliError(
+        "The original system keyring is required to complete this rename.",
+        "runtime",
+      );
+    if (movesKeyring && !backend?.create)
+      throw new CliError(
+        "This keyring has no atomic create-only operation, so API-key profile rename is unsupported for its stored entries. macOS Keychain and file-only profiles are supported. No credentials were changed.",
+        "runtime",
+      );
+    if (pending?.phase === "prepared" && movesKeyring && oldKey === null)
+      throw new CliError(
+        "The original keyring entry is missing. Restore it before retrying the rename.",
+        "runtime",
+      );
+
+    // API keys have no historical organization-ID binding. The exact stored key,
+    // never an invocation override, proves its organization and current URL slug.
+    const configBefore = existsSync(path) ? readFileSync(path, "utf8") : null;
+    const referenceBefore = existsSync(referencePath) ? readFileSync(referencePath, "utf8") : null;
+    await validate(apiKey);
+    if (
+      (existsSync(path) ? readFileSync(path, "utf8") : null) !== configBefore ||
+      (existsSync(referencePath) ? readFileSync(referencePath, "utf8") : null) !==
+        referenceBefore ||
+      readAccount(from) !== oldKey ||
+      readAccount(to) !== destinationKey ||
+      [from, to].some(
+        (slug) => readAccount(oauthAccount(slug)) !== null || readAccount(`app:${slug}`) !== null,
+      )
+    )
+      throw new CliError(
+        "Profile storage changed during validation. Retry the rename; no credentials were removed.",
+        "runtime",
+      );
+
+    const state: ProfileRename = pending ?? { from, to, phase: "prepared", keyring: movesKeyring };
+    started = true;
+    if (!pending) {
+      obj.api_key_profile_rename = state;
+      writeUserObject(path, obj);
+    }
+    if (state.phase === "prepared") {
+      if (movesKeyring) {
+        step = "copy and verify the destination API key in the system keyring";
+        // A prior prepared attempt may already have copied this exact key.
+        // Otherwise the backend itself must reject a concurrent destination.
+        if (destinationKey === null) backend!.create!(to, apiKey);
+        if (readAccount(to) !== apiKey) throw new Error("Keyring copy could not be verified");
+      }
+      ws[to] = { ...(ws[from] ?? {}) };
+      if (!entry.apiKey) ws[to]!.keyring = true;
+      delete ws[from];
+      if (user.defaultWorkspace === from) obj.default_workspace = to;
+      if (obj.workspace === from) obj.workspace = to;
+      obj.api_key_profile_rename = { ...state, phase: "committed" };
+      step = "commit the renamed profile in the private user config";
+      writeUserObject(path, obj);
+    }
+
+    // Preserve unknown reference settings. Its inline-key format is never read
+    // as a credential source and must never be rewritten as a workspace list.
+    let updatedReference: string | null = null;
+    const reference = readReferenceCredentials(referencePath);
+    if (reference.workspaces.includes(from)) {
+      const referenceObj = readUserObject(referencePath);
+      referenceObj.workspaces = [
+        ...new Set(reference.workspaces.map((s) => (s === from ? to : s))),
+      ];
+      if (referenceObj.default === from) referenceObj.default = to;
+      step = "update the reference CLI's shared credentials list";
+      writeUserObject(referencePath, referenceObj);
+      updatedReference = referencePath;
+    }
+    if (movesKeyring) {
+      step = "remove the old API-key entry from the system keyring";
+      if (
+        readAccount(to) !== apiKey ||
+        (readAccount(from) !== null && readAccount(from) !== apiKey)
+      )
+        throw new Error("Keyring changed before cleanup");
+      backend!.delete(from);
+      if (readAccount(from) !== null) throw new Error("Old keyring entry remains");
+    }
+    step = "clear the recovery marker in the private user config";
+    delete obj.api_key_profile_rename;
+    writeUserObject(path, obj);
+    return {
+      path,
+      storage: entry.apiKey ? "file" : "keychain",
+      team: asString(ws[to]?.team) ?? null,
+      defaultWorkspace:
+        asString(obj.default_workspace) ??
+        (reference.defaultWorkspace === from ? to : reference.defaultWorkspace) ??
+        null,
+      referenceCredentialsPath: updatedReference,
+    };
+  } catch (err) {
+    if (!started) throw err;
+    // Store errors may contain secrets. Keep a stable recovery instruction and
+    // retain the marker; at least one validated copy always precedes deletion.
+    throw new CliError(
+      `Profile rename is incomplete: could not ${step}. No grant was revoked. A credential copy is retained under '${from}' or '${to}'. Rerun \`${retry}\` to resume; do not log out either profile during recovery.`,
+      "runtime",
+    );
+  } finally {
+    releaseLockMarker(lock);
+  }
+}
+
+/** Read-only report: discovery is bounded to cwd plus explicitly supplied files. */
+export function profileRenameProjectUpdates(from: string, to: string, paths: string[]) {
+  return [...new Set(paths)].flatMap((path) => {
+    const { settings } = readTomlFile(path);
+    return settings.workspace === from ? [{ path, key: "workspace", from, to }] : [];
+  });
+}
+
 export interface WriteCredentialResult {
   /** Our config file — always written (the slug list lives there). */
   path: string;
@@ -1708,7 +1955,7 @@ export function redactKey(key: string | undefined): string {
 // ---------------------------------------------------------------------------
 
 /** The settings `config set` / `config init` will write to a project file. */
-export const SETTABLE_KEYS = ["team", "workspace", "sort"] as const;
+export const SETTABLE_KEYS = ["team", "workspace", "sort", "project"] as const;
 export type SettableKey = (typeof SETTABLE_KEYS)[number];
 
 /**
@@ -1719,6 +1966,7 @@ export type SettableKey = (typeof SETTABLE_KEYS)[number];
 const KEY_ALIASES: Record<SettableKey, readonly string[]> = {
   team: ["team", "team_id"],
   workspace: ["workspace"],
+  project: ["project"],
   sort: ["sort", "issue_sort"],
 };
 

package/src/lib/keyring.ts

@@ -35,6 +35,8 @@ export interface KeyringBackend {
   get(account: string): string | null;
   /** Create or replace the entry. */
   set(account: string, secret: string): void;
+  /** Atomically create a new entry, failing if it exists. Absent when unsupported. */
+  create?(account: string, secret: string): void;
   /** Remove the entry. Returns false when there was none. */
   delete(account: string): boolean;
 }
@@ -118,6 +120,26 @@ export const macosKeychain: KeyringBackend = {
     }
   },
 
+  create(account, secret) {
+    // Omitting -U makes the Keychain enforce uniqueness at insertion time.
+    // Keep the credential on stdin, just like set(), but never replace a racer.
+    const line =
+      [
+        "add-generic-password",
+        "-a",
+        quoteForSecurity(account, "workspace slug"),
+        "-s",
+        KEYRING_SERVICE,
+        "-w",
+        quoteForSecurity(secret, "API key"),
+      ].join(" ") + "\n";
+    const result = runSecurity(["-i"], line);
+    if (result.status !== 0)
+      throw new KeyringError(
+        "Could not create the destination keychain entry; it may already exist or the keychain is unavailable.",
+      );
+  },
+
   delete(account) {
     const r = runSecurity(["delete-generic-password", "-a", account, "-s", KEYRING_SERVICE]);
     if (r.status === 0) return true;
@@ -145,6 +167,8 @@ function runSecretTool(args: string[], input?: string) {
 export const linuxSecretService: KeyringBackend = {
   name: "secret-service",
   label: "system keyring (Secret Service)",
+  // secret-tool store replaces matching items and exposes no atomic create-only
+  // operation. Deliberately omit create rather than emulate it with get + set.
 
   get(account) {
     const r = runSecretTool(["lookup", "service", KEYRING_SERVICE, "account", account]);
@@ -265,6 +289,10 @@ export function memoryKeyring(initial: Record<string, string> = {}): KeyringBack
     store,
     get: (a) => store.get(a) ?? null,
     set: (a, s) => void store.set(a, s),
+    create: (a, s) => {
+      if (store.has(a)) throw new KeyringError("Destination keyring entry already exists.");
+      store.set(a, s);
+    },
     delete: (a) => store.delete(a),
   };
 }

package/src/lib/options.ts

@@ -359,6 +359,16 @@ export function addGlobalOptions(program: Command): Command {
 
 /** Commands whose output `--fields` projects: everything that renders a table or a detail block. */
 export const FIELDS_COMMANDS: ReadonlySet<string> = new Set([
+  "release list",
+  "release view",
+  "release issues",
+  "release links",
+  "release-pipeline list",
+  "release-pipeline view",
+  "release-stage list",
+  "release-stage view",
+  "release-note list",
+  "release-note view",
   "whoami",
   "auth whoami",
   "auth status",
@@ -424,6 +434,12 @@ export const FIELDS_COMMANDS: ReadonlySet<string> = new Set([
 
 /** Commands with bounded lists: `--limit <n>` caps them, `--all` (or `--limit 0`) exhausts them. */
 export const LIMIT_COMMANDS: ReadonlySet<string> = new Set([
+  "release list",
+  "release issues",
+  "release links",
+  "release-pipeline list",
+  "release-stage list",
+  "release-note list",
   "changelog",
   "attachment list",
   "comment list",
@@ -501,6 +517,8 @@ export const TEAM_COMMANDS: ReadonlySet<string> = new Set([
 
 /** Commands whose confirmation prompt is bypassed by `--yes`. */
 export const YES_COMMANDS: ReadonlySet<string> = new Set([
+  "release remove-issue",
+  "release-note delete",
   "attachment delete",
   "auth logout",
   "comment delete",

package/src/lib/output-shapes.ts

@@ -68,6 +68,16 @@ import {
 } from "../services/team.js";
 import { USER_DETAIL_SHAPE, USER_ROW_SHAPE } from "../services/user.js";
 import { WEBHOOK_DETAIL_SHAPE, WEBHOOK_ROW_SHAPE } from "../services/webhook.js";
+import {
+  RELEASE_ROW_SHAPE,
+  RELEASE_DETAIL_SHAPE,
+  PIPELINE_ROW_SHAPE,
+  STAGE_ROW_SHAPE,
+  NOTE_ROW_SHAPE,
+  NOTE_DETAIL_SHAPE,
+  RELEASE_ISSUE_SHAPE,
+  RELEASE_LINK_SHAPE,
+} from "../services/release.js";
 import type { UpdateRow } from "../lib/status-update.js";
 import type { SettingOrigin, SettingOrigins } from "../config.js";
 import type { CommandNode } from "./introspect.js";
@@ -173,6 +183,7 @@ const SETTING_ORIGIN_SHAPE = shape<SettingOrigin>({
 const SETTING_ORIGINS_SHAPE = shape<SettingOrigins>({
   team: SETTING_ORIGIN_SHAPE,
   workspace: SETTING_ORIGIN_SHAPE,
+  project: SETTING_ORIGIN_SHAPE,
   sort: SETTING_ORIGIN_SHAPE,
 });
 
@@ -186,6 +197,7 @@ const CONFIG_SHOW_SHAPE: ObjectFields = {
   workspaceProfile: "string|null",
   team: "string|null",
   workspace: "string|null",
+  project: "string|null",
   sort: "string",
   origins: SETTING_ORIGINS_SHAPE,
   userConfigPath: "string",
@@ -311,6 +323,39 @@ const RAW_API: OutputShape = {
 // ---------------------------------------------------------------------------
 
 export const OUTPUT_SHAPES: Record<string, OutputShape | null> = {
+  release: null,
+  "release list": list(RELEASE_ROW_SHAPE),
+  "release view": object(RELEASE_DETAIL_SHAPE),
+  "release create": receipt(RELEASE_DETAIL_SHAPE),
+  "release update": receipt(RELEASE_DETAIL_SHAPE),
+  "release sync": receipt(RELEASE_DETAIL_SHAPE),
+  "release update-version": receipt(RELEASE_DETAIL_SHAPE),
+  "release complete": receipt(RELEASE_DETAIL_SHAPE),
+  "release issues": list(RELEASE_ISSUE_SHAPE),
+  "release links": list(RELEASE_LINK_SHAPE),
+  "release add-issue": receipt({
+    id: "string",
+    releaseId: "string",
+    issueId: "string",
+    identifier: "string",
+  }),
+  "release remove-issue": receipt({ releaseId: "string", issue: "string", removed: "boolean" }),
+  "release-pipeline": null,
+  "release-pipeline list": list(PIPELINE_ROW_SHAPE),
+  "release-pipeline view": object(PIPELINE_ROW_SHAPE),
+  "release-pipeline create": receipt(PIPELINE_ROW_SHAPE),
+  "release-pipeline update": receipt(PIPELINE_ROW_SHAPE),
+  "release-stage": null,
+  "release-stage list": list(STAGE_ROW_SHAPE),
+  "release-stage view": object(STAGE_ROW_SHAPE),
+  "release-stage create": receipt(STAGE_ROW_SHAPE),
+  "release-stage update": receipt(STAGE_ROW_SHAPE),
+  "release-note": null,
+  "release-note list": list(NOTE_ROW_SHAPE),
+  "release-note view": object(NOTE_DETAIL_SHAPE),
+  "release-note create": receipt(NOTE_DETAIL_SHAPE),
+  "release-note update": receipt(NOTE_DETAIL_SHAPE),
+  "release-note delete": receipt({ id: "string", deleted: "boolean" }),
   api: RAW_API,
 
   changelog: list({
@@ -360,6 +405,22 @@ export const OUTPUT_SHAPES: Record<string, OutputShape | null> = {
     teamMetadataRemoved: "boolean",
   }),
   "auth migrate": receipt({ success: "boolean", migrated: ["string"], path: "string" }),
+  "auth rename": receipt({
+    success: "boolean",
+    from: "string",
+    workspace: "string",
+    credentialType: "string",
+    organization: { id: "string", name: "string", urlKey: "string" },
+    path: "string",
+    storage: "string",
+    team: "string|null",
+    defaultWorkspace: "string|null",
+    referenceCredentialsPath: "string|null",
+    checkedProjectConfigs: ["string"],
+    projectConfigUpdates: [{ path: "string", key: "string", from: "string", to: "string" }],
+    globalConfigUpdates: [{ path: "string", key: "string", from: "string", to: "string" }],
+    otherProjects: "string",
+  }),
   "auth status": object({
     authenticated: "boolean",
     credentialType: "string|null",
@@ -393,7 +454,13 @@ export const OUTPUT_SHAPES: Record<string, OutputShape | null> = {
   completion: { kind: "none", note: "always prints a shell script; --json has no effect" },
 
   config: runs("config show", object(CONFIG_SHOW_SHAPE)),
-  "config init": receipt({ success: "boolean", path: "string", team: "string", "sort?": "string" }),
+  "config init": receipt({
+    success: "boolean",
+    path: "string",
+    team: "string",
+    "sort?": "string",
+    "project?": "string",
+  }),
   "config set": receipt({
     success: "boolean",
     path: "string",